Fix form redirection
Fix form redirection

Form redirection was broken:

    * If the form success page doesn't have a “from” parameter, the
    success page raises an Error.
    (Fixed with the try...except KeyError)

    * If the “from” parameter is relative, or if it is something
    like '"><img src="'. It raises a NoReverseMatch, because Django
    thinks it's a module, and tries to import it. This could lead to a
    remote code execution if a user succeed to put a __init__.py file in
    the /media/ directory and succeed to import it.
    (Fixed by using HttpResponsePermanentRedirect instead of redirect() )

    * If the “from” parameter is “http://example.com” widgy will
    redirect to example.com, allowing somebody to give links like:
    <http://good.example.com/form/success/?from=http://evil.example.com/>.
    <http://evil.example.com/> can be fully URL encoded in order to
    hide it.
    (Fixed by using is_safe_url)

j00bar/django-widgy,j00bar/django-widgy,j00bar/django-widgy